Community College LAN Design Considerations SBA

LAN Design Figure 2 Community College LAN Design

The community college LAN design is a multi-campus design, where a campus consists
of multiple buildings and services at each location, as shown in Figure 1. Service Fabric Design Model
Figure 1 Community College LAN Design

Unified
Large Building Medium Building Small Building Extra Small Building Mobility Security
Communications

Local Area Wide Area

Network (LAN) Network (LAN)

228469
Services
Block
This chapter focuses on the LAN component of the overall design. The LAN component
consists of the LAN framework and network foundation technologies that provide
Data
Center baseline routing and switching guidelines. The LAN design interconnects several other
components, such as endpoints, data center, WAN, and so on, to provide a foundation on
Internet
which mobility, security, and unified communications (UC) can be integrated into the
Main Campus Edge overall design.
This LAN design provides guidance on building the next-generation community college
WAN PSTN Internet network, which becomes a common framework along with critical network technologies to
deliver the foundation for the service fabric design. This chapter is divided into following
sections:
Services
Block
Services
Block
• LAN design principles—Provides proven design choices to build various types of
Services LANs.
Block
Data Data
• LAN design model for the community college—Leverages the design principles of
Center Center the tiered network design to facilitate a geographically dispersed college campus
Data
Center
network made up of various elements, including networking role, size, capacity, and
infrastructure demands.
Remote Small Campus • Considerations of a multi-tier LAN design model for community colleges—Provides
guidance for the college campus LAN network as a platform with a wide range of
next-generation products and technologies to integrate applications and solutions
seamlessly.
Large Building Medium Building Small Building Medium Building Small Building
• Designing network foundation services for LAN designs in community
228468

Remote Large Campus Remote Medium Campus

colleges—Provides guidance on deploying various types of Cisco IOS technologies
to build a simplified and highly available network design to provide continuous
Figure 2 shows the service fabric design model used in the community college LAN
network operation. This section also provides guidance on designing
design. network-differentiated services that can be used to customize the allocation of
network resources to improve user experience and application performance, and to
protect the network against unmanaged devices and applications.
Community College LAN Design SBA

LAN Design Principles The key layers are access, distribution and core. Each layer can be seen as a well-defined
structured module with specific roles and functions in the LAN network. Introducing
Any successful design or system is based on a foundation of solid design theory and
principles. Designing the LAN component of the overall community college LAN service modularity in the LAN hierarchical design further ensures that the LAN network remains
resilient and flexible to provide critical network services as well as to allow for growth and
fabric design model is no different than designing any large networking system. The use
of a guiding set of fundamental engineering design principles serves to ensure that the changes that may occur in a community college.
LAN design provides for the balance of availability, security, flexibility, and manageability • Access layer
required to meet current and future college and technology needs. This chapter provides The access layer represents the network edge, where traffic enters or exits the
design guidelines that are built upon the following principles to allow a community college campus network. Traditionally, the primary function of an access layer switch is to
network architect to build college campuses that are located in different geographical provide network access to the user. Access layer switches connect to the distribution
locations: layer switches to perform network foundation technologies such as routing, quality of
• Hierarchical service (QoS), and security.
– Facilitates understanding the role of each device at every tier To meet network application and end-user demands, the next-generation Cisco
– Simplifies deployment, operation, and management Catalyst switching platforms no longer simply switch packets, but now provide
intelligent services to various types of endpoints at the network edge. Building
– Reduces fault domains at every tier intelligence into access layer switches allows them to operate more efficiently,
• Modularity—Allows the network to grow on an on-demand basis optimally, and securely.
• Resiliency—Satisfies user expectations for keeping network always on • Distribution layer
• Flexibility—Allows intelligent traffic load sharing by using all network resources The distribution layer interfaces between the access layer and the core layer to
These are not independent principles. The successful design and implementation of a provide many key functions, such as the following:
college campus network requires an understanding of how each of these principles – Aggregating and terminating Layer 2 broadcast domains
applies to the overall design. In addition, understanding how each principle fits in the – Aggregating Layer 3 routing boundaries
context of the others is critical in delivering a hierarchical, modular, resilient, and flexible
– Providing intelligent switching, routing, and network access policy functions to
network required by community colleges today.
access the rest of the network
Designing the community college LAN building blocks in a hierarchical fashion creates a
flexible and resilient network foundation that allows network architects to overlay the – Providing high availability through redundant distribution layer switches to the
end-user and equal cost paths to the core, as well as providing differentiated
security, mobility, and UC features essential to the service fabric design model, as well as
providing an interconnect point for the WAN aspect of the network. The two proven, services to various classes of service applications at the edge of network
time-tested hierarchical design frameworks for LAN networks are the three-tier layer and • Core layer
the two-tier layer models, as shown in Figure 3. The core layer is the network backbone that connects all the layers of the LAN design,
Figure 3 Three-Tier and Two-Tier LAN Design Models providing for connectivity between end devices, computing and data storage
services located within the data center and other areas, and services within the
Three-Tier Two-Tier network. The core layer serves as the aggregator for all the other campus blocks, and
LAN Design LAN Design ties the campus together with the rest of the network.
Note For more information on each of these layers, see the enterprise class network
Core
framework at the following URL:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/campover.ht
ml.

Figure 4 shows a sample three-tier LAN network design for community colleges where
the access, distribution, and core are all separate layers. To build a simplified,
Distribution Collapsed cost-effective, and efficient physical cable layout design, Cisco recommends building an
Core/Distribution extended-star physical network topology from a centralized building location to all other
buildings on the same campus.
228470

Access Access
Community College LAN Design SBA

Figure 4 Three-Tier LAN Network Design Example Figure 5 Two-Tier Network Design Example

Building B – Building C – Access

Library and Life Science Floor 6 –
Communication Center Learning Recource Center Social Science and Health

Floor 5 –
Access Arts and Technology
WAN
Floor 4 –
History and Geography
Distribution
PSTN
Floor 3 –
Building A – Library and Communication Center Collapsed
Core Administration and Distribution/
Data Center Core

228472
Floor 2 –
Administration and Data Center

Distribution If using the small-scale collapsed campus core design, the college network architect must
understand the network and application demands so that this design ensures a
hierarchical, modular, resilient, and flexible LAN network.
Access
Community College LAN Design Models
Building D – Building E – Building F –
Both LAN design models (three-tier and two-tier) have been developed with the following
considerations:
228471
Social Science Arts and History and
and Health Technology Geography
• Scalability—Based on Cisco enterprise-class high-speed 10G core switching
platforms for seamless integration of next-generation applications required for
Collapsed Core Campus Network Design community colleges. Platforms chosen are cost-effective and provide investment
The primary purpose of the core layer is to provide fault isolation and backbone protection to upgrade network as demand increases.
connectivity. Isolating the distribution and core into separate layers creates a clean • Simplicity—Reduced operational and troubleshooting cost via the use of
delineation for change control between activities affecting end stations (laptops, phones, network-wide configuration, operation, and management.
and printers) and those that affect the data center, WAN, or other parts of the network. A • Resilient—Sub-second network recovery during abnormal network failures or even
core layer also provides for flexibility in adapting the campus design to meet physical network upgrades.
cabling and geographical challenges. If necessary, a separate core layer can use a
• Cost-effectiveness—Integrated specific network components that fit budgets
different transport technology, routing protocols, or switching hardware than the rest of
without compromising performance.
the campus, providing for more flexible design options when needed.
As shown in Figure 6, multiple campuses can co-exist within a single community college
In some cases, because of either physical or network scalability, having separate
system that offers various academic programs.
distribution and core layers is not required. In smaller locations where there are less users
accessing the network or in college campus sites consisting of a single building, separate
core and distribution layers are not needed. In this scenario, Cisco recommends the
two-tier LAN network design, also known as the collapsed core network design.
Figure 5 shows a two-tier LAN network design example for a community college LAN
where the distribution and core layers are collapsed into a single layer.
Community College LAN Design SBA

Figure 6 Community College LAN Design Model Table 1 Community College Recommended LAN Design Model

HDTV
Remote medium campus Three-tier with collapsed WAN edge
IP

Main Large Campus

Remote small campus Two-tier
Large Building Medium Building Small Building Extra Small Building

Main College Campus Network Design Overview

Cisco 6500
VSS
Cisco 4500 Cisco 4500 Cisco 3750
Stackwise The main college campus in the community college design consists of a centralized hub
campus location that interconnects several sizes of remote campuses to provide
CUCM/Unitity Core
Cisco 6500 VSS DMZ
end-to-end shared network access and services, as shown in Figure 7.
ACS/CSA-MC Service
NAC Mgr DC
Block
WCS
VSOM/VSMS
DMM/CVP
WAE
ACNS ESA Web/Email
Figure 7 Main College Campus Site Reference Design
DHCP/DNS WLC
NTTP/FTP NAC
www WSA
NTP Internet Edge
Large Medium Small Extra Small
ASR Cisco 3800 ASR
Building Building Building Building
GigaPOP
MetroE HDLC PSTN
Internet NLR
HDLC
Access

Cisco 375ME Cisco 2800 Cisco 2800 Cisco 3800

VSOM/VSMS VSOM/VSMS VSOM/VSMS

WAE/ACNS DHCP/DNS WAE/ACNS DHCP/DNS WAE/ACNS
DHCP/DNS Cisco 4500
NTTP/FTP/NTP WLC/NAC NTTP/FTP/NTP WLC/NAC NTTP/FTP/NTP WLC/NAC

Appliance DC
Appliance
DC
Appliance Distribution
DC Cisco 6500 Block Block
Block VSS

Cisco 6500
VSS Cisco 4500 Cisco 4500 Cisco 4500 Cisco 4500 Cisco 4500

Data Center
Block
Core
Large Building Medium Building Small Building Medium Building Small Building Small Building
DMZ
Remote Large Campus Remote Medium Campus Remote Small Campus Service
Block

228473
HDTV HDTV
IP IP

Depending on the number of available academic programs in a remote campus, the WAN PSTN Internet
student, faculty, and staff population in remote campuses may be equal to or less than the Edge QFP Gateway QFP Edge
main college campus site. Campus network designs for the remote campus may require
adjusting based on overall college campus capacity. GigaPOP
WAN PSTN
Using high-speed WAN technology, all the remote community college campuses
Internet NLR
interconnect to a centralized main college campus that provides shared services to all the

228474
students, faculty, and staff, independent of their physical location. The WAN design is
discussed in greater detail in the next chapter, but it is worth mentioning in the LAN The main college campus typically consists of various sizes of building facilities and
section because some remote sites may integrate LAN and WAN functionality into a
various education department groups. The network scale factor in the main college
single platform. Collapsing the LAN and WAN functionality into a single Cisco platform can campus site is higher than the remote college campus site, and includes end users,
provide all the needed requirements for a particular remote site as well as provide
IP-enabled endpoints, servers, and security and network edge devices. Multiple buildings
reduced cost to the overall design, as discussed in more detail in the following section. of various sizes exist in one location, as shown in Figure 8.
Table 1 shows a summary of the LAN design models as they are applied in the overall
community college network design.

Table 1 Community College Recommended LAN Design Model

Community College Location Recommended LAN Design Model

Main campus Three-tier
Remote large campus Three-tier
Community College LAN Design SBA

Figure 8 Main College Campus Site Reference Design Figure 9 Remote Large College Campus Site Reference Design

Large Medium Small Medium Small

Building Building Building Building Building

Access Access

Distribution Distribution

Data Center Data Center

Block Block
Core Core

Service Service
Block Block

WAN PSTN WAN PSTN

Edge QFP Gateway Edge Gateway

228475

228476
WAN PSTN WAN PSTN

The three-tier LAN design model for the main college campus meets all key technical Remote Medium College Campus Site Design Overview
aspects to provide a well-structured and strong network foundation. The modularity and
Remote medium college campus locations differ from a main or remote large campus in
flexibility in a three-tier LAN design model allows easier expansion and integration in the
that there are less buildings with distributed education departments. A remote medium
main college network, and keeps all network elements protected and available.
college campus may have a fewer number of network users and endpoints, thereby
To enforce external network access policy for each end user, the three-tier model also reducing the need to build a similar campus network to that recommended for main and
provides external gateway services to the students and staff for accessing the Internet as large college campuses. Because there are fewer students, faculty, and end users at this
well as private education and research networks. site as compared to the main or remote large campus sites, the need for a separate WAN
Note The WAN design is a separate element in this location because it requires a device may not be necessary. A remote medium college campus network is designed
separate WAN device that connects to the three-tier LAN model. WAN design is similarly to a three-tier large campus LAN design. All the LAN benefits are achieved in a
discussed in more detail in the Community College WAN Design document. three-tier design model as in the main and remote large campus, and in addition, the
platform chosen in the core layer also serves as the WAN edge, thus collapsing the WAN
Remote Large College Campus Site Design Overview and core LAN functionality into a single platform. Figure 10 shows the remote medium
campus in more detail.
From the location size and network scale perspective, the remote large college is not
much different from the main college campus site. Geographically, it can be distant from
the main campus site and requires a high-speed WAN circuit to interconnect both
campuses. The remote large college can also be considered as an alternate college
campus to the main campus site, with the same common types of applications, endpoints,
users, and network services. Similar to the main college campus, separate WAN devices
are recommended to provide application delivery and access to the main college
campus, given the size and number of students at this location.
Similar to the main college campus, Cisco recommends the three-tier LAN design model
for the remote large college campus, as shown in Figure 9.
Community College LAN Design SBA

Figure 10 Remote Medium College Campus Site Reference Design Figure 11 Remote Small College Campus Site Reference Design

Medium Small
Access Building Building

Data Center Access

Block
Distribution/Core
Service
Block Distribution

WAN PSTN
Edge Gateway

228477
WAN PSTN Data Center
Block
Core

Remote Small College Campus Network Design Overview Service

Block
The remote small college campus is typically confined to a single building that spans
across multiple floors with different academic departments. The network scale factor in WAN PSTN
this design is reduced compared to other large college campuses. However, the Edge Gateway
application and services demands are still consistent across the community college
locations.

228476
In such smaller scale campus network deployments, the distribution and core layer WAN PSTN
functions can collapse into the two-tier LAN model without compromising basic network
demands. Before deploying a collapsed core and distribution layer in the remote small
campus network, considering all the scale and expansion factors prevents physical
Considering Multi-Tier LAN Design Models for Community Colleges
network re-design, and improves overall network efficiency and manageability. The previous section discussed the recommended LAN design model for each
WAN bandwidth requirements must be assessed appropriately for this remote small community college location. This section provides more detailed design guidance for
campus network design. Although the network scale factor is reduced compared to other each tier in the LAN design model. Each design recommendation is optimized to keep the
larger college campus locations, sufficient WAN link capacity is needed to deliver network simplified and cost-effective without compromising network scalability, security,
consistent network services to student, faculty, and staff. Similar to the remote medium and resiliency. Each LAN design model for a community college location is based on the
campus location, the WAN functionality is also collapsed into the LAN functionality. A key LAN layers of core, distribution, and access.
single Cisco platform can provide collapsed core and distribution LAN layers. This design
Campus Core Layer Network Design
model is recommended only in smaller locations, and WAN traffic and application needs
must be considered. Figure 11 shows the remote small campus in more detail. As discussed in the previous section, the core layer becomes a high-speed intermediate
transit point between distribution blocks in different premises and other devices that
interconnect to the data center, WAN, and Internet edge.
Similarly to choosing a LAN design model based on a location within the community
college design, choosing a core layer design also depends on the size and location within
the design. Three core layer design models are available, each of which is based on either
the Cisco Catalyst 6500 Series or the Cisco Catalyst 4500 Series Switches. Figure 12
shows the three core layer design models.
Community College LAN Design SBA

Figure 12 Core Layer Design Models for Community Colleges Figure 14 VSS-Enabled Core Network Design

Design Core Design Core Design Large Medium Small Extra Small
Building Building Building Building
on – 1 Option – 2 Option – 3
Switch-2 Access

SL Collapsed
Core
Core/Distribution
Distribution

228478
alyst 6500 Cisco Catalyst 4500 Cisco Catalyst 4500
Internet Edge Block
Data Center
Block VSL
Each design model offers consistent network services, high availability, expansion Core
DMZ
flexibility, and network scalability. The following sections provide detailed design and
deployment guidance for each model as well as where they fit within the various locations Service
of the community college design. Block

Core Layer Design Option 1—Cisco Catalyst 6500-Based Core Network WAN PSTN
Edge QFP Gateway QFP
Core layer design option 1 is specifically intended for the main and remote large campus
locations. It is assumed that the number of network users, high-speed and low-latency
applications (such as Cisco TelePresence), and the overall network scale capacity is WAN PSTN Gigapop
common in both sites and thus, similar core design principles are required. Internet NLR

228480
Core layer design option 1 is based on Cisco Catalyst 6500 Series switches using the
Cisco Virtual Switching System (VSS), which is a software technology that builds a single
logical core system by clustering two redundant core systems in the same tier. Building a Note For more detailed VSS design guidance, see the Campus 3.0 Virtual Switching
VSS-based network changes network design, operation, cost, and management System Design Guide at the following URL:
dramatically. Figure 1-13 shows the physical and operational view of VSS. http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/VSS30dg/ca
mpusVSS_DG.html.
Figure 1-13 VSS Physical and Operational View
Core Layer Design Option 2—Cisco Catalyst 4500-Based Campus Core Network
Virtual Switch Domain Core layer design option 2 is intended for a remote medium-sized college campus and is
built on the same principles as for the main and remote large campus locations. The size
VSL
of this remote site may not be large, and it is assumed that this location contains
distributed building premises within the remote medium campus design. Because this
site is smaller in comparison to the main and remote large campus locations, a fully
228479

Switch-1 Switch-2 VSS – Single redundant, VSS-based core layer design may not be necessary. Therefore, core layer
Logical Switch design option 2 was developed to provide a cost-effective alternative while providing the
same functionality as core layer design option 1. Figure 15 shows the remote medium
To provide end-to-end network access, the core layer interconnects several other campus core design option in more detail.
network systems that are implemented in different roles and service blocks. Using VSS to
virtualize the core layer into a single logical system remains transparent to each network
device that interconnects to the VSS-enabled core. The single logical connection
between core and the peer network devices builds a reliable, point-to-point connection
that develops a simplified network topology and builds distributed forwarding tables to
fully use all resources. Figure 14 shows a reference VSS-enabled core network design for
the main campus site.
Community College LAN Design SBA

Figure 15 Remote Medium Campus Core Network Design Figure 16 Highly Redundant Single Core Design Using the Cisco Catalyst 4500-E Platform

Medium Small
Building Building undant
ervisor
Access Redundant
Line Cards
undant
Cycle
Distribution
sed
aths
Shared Service Block

Data Center
Block

228482
Core

Service
Block This core network design builds a network topology that has similar common design
principles to the VSS-based campus core in core layer design option 1. The future
WAN PSTN
Edge Gateway expansion from a single core to a dual VSS-based core system becomes easier to deploy,
and helps retain the original network topology and the management operation. This
cost-effective single resilient core system for a medium-size college network meets the
WAN PSTN 228481 following four key goals:
• Scalability—The modular Cisco Catalyst 4500 chassis enables flexibility for core
The cost of implementing and managing redundant systems in each tier may introduce network expansion with high throughput modules and port scalability without
complications in selecting the three-tier model, especially when network scale factor is compromising network performance.
not too high. This cost-effective core network design provides protection against various • Resiliency—Because hardware or software failure conditions may create
types of hardware and software failure and offers sub-second network recovery. Instead catastrophic results in the network, the single core system must be equipped with
of a redundant node in the same tier, a single Cisco Catalyst 4500-E Series Switch can be redundant system components such as supervisor, line card, and power supplies.
deployed in the core role and bundled with 1+1 redundant in-chassis network Implementing redundant components increases the core network resiliency during
components. The Cisco Catalyst 4500-E Series modular platform is a one-size platform various types of failure conditions using Non-Stop Forwarding/Stateful Switch Over
that helps enable the high-speed core backbone to provide uninterrupted network (NSF/SSO) and EtherChannel technology.
access within a single chassis. Although a fully redundant, two-chassis design using VSS • Simplicity—The core network can be simplified with redundant network modules
as described in core layer option 1 provides the greatest redundancy for large-scale and diverse fiber connections between the core and other network devices. The
locations, the redundant supervisors and line cards of the Cisco Catalyst 4500-E provide Layer 3 network ports must be bundled into a single point-to-point logical
adequate redundancy for smaller locations within a single platform. Figure 16 shows the EtherChannel to simplify the network, such as the VSS-enabled campus design. An
redundancy of the Cisco Catalyst 4500-E Series in more detail. EtherChannel-based campus network offers similar benefits to an Multi-chassis
EtherChannel (MEC)- based network.
• Cost-effectiveness—A single core system in the core layer helps reduce capital,
operational, and management cost for the medium-sized campus network design.

Core Layer Design Option 3—Cisco Catalyst 4500-Based Collapsed Core Campus
Network
Core layer design option 3 is intended for the remote small campus network that has
consistent network services and applications service-level requirements but at reduced
network scale. The remote small campus is considered to be confined within a single
multi-story building that may span academic departments across different floors. To
provide consistent services and optimal network performance, scalability, resiliency,
simplification, and cost-effectiveness in the small campus network design must not be
compromised.
Community College LAN Design SBA

As discussed in the previous section, the remote small campus has a two-tier LAN design deployed in main or remote college campus locations, depending on network scale,
model, so the role of the core system is merged with the distribution layer. Remote small application demands, and cost, as shown in Figure 18. Each design model offers
campus locations have consistent design guidance and best practices defined for main, consistent network services, high availability, expansion flexibility, and network scalability.
remote large, and remote medium-sized campus cores. However, for platform selection,
Figure 18 Distribution Layer Design Model Options
the remote medium campus core layer design must be leveraged to build this two-tier
campus core. Design Option – 1 Design Option – 2 Design Option – 3
Single highly resilient Cisco Catalyst 4500 switches with a Cisco Sup6L-E supervisor
must be deployed in a centralized collapsed core and distribution role that interconnects Switch-1 Switch-2
to wiring closet switches, a shared service block, and a WAN edge router. The VSL
cost-effective supervisor version supports key technologies such as robust QoS, high Distribution Distribution Distribution
availability, security, and much more at a lower scale, making it an ideal solution for
small-scale network designs. Figure 17 shows the remote small campus core design in
more detail.
Figure 17 Core Layer Option 3 Collapsed Core/Distribution Network Design in Remote Small
Campus Location Access Access Access

228484
Medium Small
Building Building

Access Distribution Layer Design Option 1—Cisco Catalyst 6500-E Based Distribution
Network
Distribution layer design option 1 is intended for main campus and remote large campus
Distribution locations, and is based on Cisco Catalyst 6500 Series switches using the Cisco VSS, as
shown in Figure 19.
Figure 19 VSS-Enabled Distribution Layer Network Design
Shared Service Block
Floor 1 – TP
Data Center Conferance
Block Room Floor 2 –
Core Science Lab Floor 3 –
Library
Service Access
Block

WAN PSTN
Edge Gateway
228481

WAN PSTN Switch-1 Switch-2

VSL
Distribution

228485
Campus Distribution Layer Network Design
The distribution or aggregation layer is the network demarcation boundary between The distribution block and core network operation changes significantly when redundant
wiring-closet switches and the campus core network. The framework of the distribution Cisco Catalyst 6500-E Series switches are deployed in VSS mode in both the distribution
layer system in the community college design is based on best practices that reduce and core layers. Clustering redundant distribution switches into a single logical system
network complexities and accelerate reliability and performance. To build a strong with VSS introduces the following technical benefits:
campus network foundation with the three-tier model, the distribution layer has a vital role • A single logical system reduces operational, maintenance, and ownership cost.
in consolidating networks and enforcing network edge policies.
• A single logical IP gateway develops a unified point-to-point network topology in the
Following the core layer design options in different campus locations, the distribution distribution block, which eliminates traditional protocol limitations and enables the
layer design provides consistent network operation and configuration tools to enable network to operate at full capacity.
various network services. Three simplified distribution layer design options can be
Community College LAN Design SBA

• Implementing the distribution layer in VSS mode eliminates or reduces several Figure 20 Core/Distribution Layer Interconnection Design Considerations
deployment barriers, such as spanning-tree loop, Hot Standby Routing Protocol
Design Option – 1 Design Option – 2 Design Option – 3 Design Option – 4 Design Option – 5
(HSRP)/Gateway Load Balancing Protocol (GLBP)/Virtual Router Redundancy Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2
Protocol (VRRP), and control plane overhead. Distribution VSL VSL VSL VSL VSL

• Cisco VSS introduces unique inter-chassis traffic engineering to develop a VSS

Domain
fully-distributed forwarding design that helps in increased bandwidth, load ID : 1

balancing, predictable network recovery, and network stability.

Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2 Switch-1 Switch-2
Deploying VSS mode in both the distribution layer switch and core layer switch provides Access VSL VSL VSL VSL VSL
numerous technology deployment options that are not available when not using VSS. VSS

228486
Domain
Designing a common core and distribution layer option using VSS provides greater ID : 2
redundancy and is able to handle the amount of traffic typically present in the main and
remote large campus locations. Figure 20 shows five unique VSS domain interconnect
options. Each variation builds a unique network topology that has a direct impact on
steering traffic and network recovery.
The various core/distribution layer interconnects offer the following: Figure 21 Two Cisco Catalyst 4500-E-Based Distribution Layer Options
• Core/distribution layer interconnection option 1—A single physical link between Distribution Design 1 – Distribution Design 2 –
each core switch with the corresponding distribution switch. Hybrid Distribution Block Multi-Layer Distribution Block
• Core/distribution layer interconnection option 2—A single physical link between Floor 1 – TP Floor 1 – TP
each core switch with the corresponding distribution switch, but each link is logically Conference Conference
Room Floor 2 – Room Floor 2 –
grouped to appear as one single link between the core and distribution layers. Science Lab Floor 3 – Science Lab Floor 3 –
• Core/distribution layer interconnection option 3—Two physical links between each Library Library
core switch with the corresponding distribution switch. This design creates four Access
equal cost multi-path (ECMP) with multiple control plane adjacency and redundant
path information. Multiple links provide greater redundancy in case of link failover.
• Core/distribution layer interconnection option 4—Two physical links between each
core switch with the corresponding distribution switch. There is one link direction
between each switch as well as one link connecting to the other distribution switch. Distribution
The additional link provides greater redundancy in case of link failover. Also these

228487
links are logically grouped to appear like option 1 but with greater redundancy.
Cisco Catalyst 4500-E – Sup6-E Cisco Catalyst 4500-E – Sup6E-L
• Core/distribution layer interconnection option 5—This provides the most
redundancy between the VSS-enabled core and distribution switches as well as the The hybrid distribution block must be deployed with the next-generation supervisor
most simplified configuration, because it appears as if there is only one logical link Sup6-E module. Implementing redundant Sup6-Es in the distribution layer can
between the core and the distribution. Cisco recommends deploying this option interconnect access layer switches and core layer switches using a single point-to-point
because it provides higher redundancy and simplicity compared to any other logical connection. This cost-effective and resilient distribution design option leverages
deployment option. core layer design option 2 to take advantage of all the operational consistency and
architectural benefits.
Distribution Layer Design Option 2—Cisco Catalyst 4500-E-Based Distribution Alternatively, the multilayer distribution block option requires the Cisco Catalyst 4500-E
Network Series Switch with next-generation supervisor Sup6E-L deployed. The Sup6E-L
supervisor is a cost-effective distribution layer solution that meets all network foundation
Two cost-effective distribution layer models have been designed for the medium-sized
requirements and can operate at moderate capacity, which can handle a medium-sized
and small-sized buildings within each campus location that interconnect to the
college distribution block.
centralized core layer design option and distributed wiring closet access layer switches.
Both models are based on a common physical LAN network infrastructure and can be This distribution layer network design provides protection against various types of
chosen based on overall network capacity and distribution block design. Both distribution hardware and software failure, and can deliver consistent sub-second network recovery.
layer design options use a cost-effective single and highly resilient Cisco Catalyst 4500 A single Catalyst 4500-E with multiple redundant system components can be deployed to
as an aggregation layer system that offers consistent network operation like a offer 1+1 in-chassis redundancy, as shown in Figure 22.
VSS-enabled distribution layer switch. The Cisco Catalyst 4500 Series provides the same
technical benefits of VSS for a smaller network capacity within a single Cisco platform.
The two Cisco Catalyst 4500-E-based distribution layer options are shown in Figure 21.
Community College LAN Design SBA

Figure 22 Highly Redundant Single Distribution Design Figure 23 Cisco StackWise Plus-enabled Distribution Layer Network Design

Floor 1 – TP Utilities Storage S/H

Conference Department Department Department
Room Floor 2 –
Science Lab Floor 3 – Access
Library
Access

228489
Distribution

Redundant
Supervisor While providing consistent network services throughout the campus, a number of network
Redundant
Distribution
Line Cards users and IT-managed remote endpoints can be limited in this building. This distribution

228488
Redundant layer design option recommends using the Cisco Catalyst 3750-E StackWise Plus Series
Power Cycle
platform for the distribution layer switch.
Distribution layer design option 2 is intended for the remote medium-sized campus
The fixed-configuration Cisco Catalyst 3750-E Series Switch is a multilayer platform that
locations, and is based on the Cisco Catalyst 4500 Series Switches. Although the remote
supports Cisco StackWise Plus technology to simplify the network and offers flexibility to
medium and the main and remote large campus locations share similar design principles,
expand the network as it grows. With Cisco StackWise Plus technology, the Catalyst
the remote medium campus location is smaller and may not need a VSS-based
3750-E can be clustered into a high-speed backplane stack ring to logically build as a
redundant design. Fortunately, network upgrades and expansion become easier to
single large distribution system. Cisco StackWise Plus supports up to nine switches into
deploy using distribution layer option 2, which helps retain the original network topology
single stack ring for incremental network upgrades, and increases effective throughput
and the management operation. Distribution layer design option 2 meets the following
capacity up to 64 Gbps. The chassis redundancy is achieved via stacking, in which
goals:
member chassis replicate the control functions with each member providing distributed
• Scalability—The modular Cisco Catalyst 4500 chassis provides the flexibility for packet forwarding. This is achieved by stacked group members acting as a single virtual
distribution block expansion with high throughput modules and port scalability Catalyst 3750-E switch. The logical switch is represented as one switch by having one
without compromising network performance. stack member act as the master switch. Thus, when failover occurs, any member of the
• Resiliency—The single distribution system must be equipped with redundant stack can take over as a master and continue the same services. It is a 1:N form of
system components, such as supervisor, line card, and power supplies. redundancy where any member can become the master. This distribution layer design
Implementing redundant components increases network resiliency during various option is ideal for the remote small campus location.
types of failure conditions using NSF/SSO and EtherChannel technology.
Campus Access Layer Network Design
• Simplicity—This cost-effective design simplifies the distribution block similarly to a
VSS-enabled distribution system. The single IP gateway design develops a unified The access layer is the first tier or edge of the campus, where end devices such as PCs,
point-to-point network topology in the distribution block to eliminate traditional printers, cameras, Cisco TelePresence, and so on attach to the wired portion of the
protocol limitations, enabling the network to operate at full capacity. campus network. It is also the place where devices that extend the network out one more
• Cost-effectiveness—The single distribution system in the core layer helps reduce level, such as IP phones and wireless access points (APs), are attached. The wide variety
capital, operational, and ownership cost for the medium-sized campus network of possible types of devices that can connect and the various services and dynamic
design. configuration mechanisms that are necessary, make the access layer one of the most
feature-rich parts of the campus network. Not only does the access layer switch allow
Distribution Layer Design Option 3—Cisco Catalyst 3750-E StackWise-Based users to access the network, the access layer switch must provide network protection so
Distribution Network that unauthorized users or applications do not enter the network. The challenge for the
network architect is determining how to implement a design that meets this wide variety
Distribution layer design option 3 is intended for a very small building with a limited of requirements, the need for various levels of mobility, the need for a cost-effective and
number of wiring closet switches in the access layer that connects remote classrooms or flexible operations environment, while being able to provide the appropriate balance of
and office network with a centralized core, as shown in Figure 23. security and availability expected in more traditional, fixed-configuration environments.
The next-generation Cisco Catalyst switching portfolio includes a wide range of fixed and
modular switching platforms, each designed with unique hardware and software
capability to function in a specific role.
Community college campuses may deploy a wide range of network endpoints. The
campus network infrastructure resources operate in shared service mode, and include
IT-managed devices such as Cisco TelePresence and non-IT-managed devices such as
Community College LAN Design SBA

student laptops. Based on several endpoint factors such as function and network For a college campus network, the Cisco Catalyst 3560-E is an alternate switching
demands and capabilities, two access layer design options can be deployed with college solution for the multilayer distribution block design option discussed in the previous
campus network edge platforms, as shown in Figure 24. section. The Cisco Catalyst 3560-E Series Switches offer limited software feature support
that can function only in a traditional Layer 2 network design. To provide a consistent
Figure 24 Access Layer Design Models
end-to-end enhanced user experience, the Cisco Catalyst 2960-E supports critical
Access Design Option 1 – Access Design Option 2 – network control services to secure the network edge, intelligently provide differentiated
Modular/Stackable Fix Configuration services to various class-of-service traffic, as well as simplified management. The Cisco
Catalyst must leverage the 1G dual uplink port to interconnect the distribution system for
increased bandwidth capacity and network availability.
Access Both design options offer consistent network services at the campus edge to provide
differentiated, intelligent, and secured network access to trusted and untrusted
Cisco Cisco Cisco Cisco endpoints. The distribution options recommended in the previous section can
Catalyst 4500-E Catalyst 3750-E Catalyst 3560-E Catalyst 2960-E accommodate both access layer design options.

228490
Sup6E-L StackWise Plus
Community College Network Foundation Services Design
Access Layer Design Option 1—Modular/StackWise Plus Access Layer Network After each tier in the model has been designed, the next step for the community college
design is to establish key network foundation services. Regardless of the application
Access layer design option 1 is intended to address the network scalability and availability function and requirements that community colleges demand, the network must be
for the IT-managed critical voice and video communication network edge devices. To designed to provide a consistent user experience independent of the geographical
accelerate user experience and college campus physical security protection, these location of the application. The following network foundation design principles or services
devices require low latency, high performance, and a constant network availability must be deployed in each campus location to provide resiliency and availability for all
switching infrastructure. Implementing a modular and Cisco StackWise Plus-capable users to obtain and use the applications the community college offers:
platform provides flexibility to increase network scale in the densely populated campus
• Network addressing hierarchy
network edge.
The Cisco Catalyst 4500-E with supervisor Sup6E-L can be deployed to protect devices • Network foundation technologies for LAN designs
against access layer network failure. Cisco Catalyst 4500-E Series platforms offer • Multicast for applications delivery
consistent and predictable sub-second network recovery using NSF/SSO technology to • QoS for application performance optimization
minimize the impact of outages on college business and IT operation. • High availability to ensure user experience even with a network failure
The Cisco Catalyst 3750-E Series is the alternate Cisco switching platform in this design
Design guidance for each of these five network foundation services are discussed in the
option. Cisco StackWise Plus technology provides flexibility and availability by clustering following sections, including where they are deployed in each tier of the LAN design
multiple Cisco Catalyst 3750-E Series Switches into a single high-speed stack ring that
model, the campus location, and capacity.
simplifies operation and allows incremental access layer network expansion. The Cisco
Catalyst 3750-E Series leverages EtherChannel technology for protection during Network Addressing Hierarchy
member link or stack member switch failure.
Developing a structured and hierarchical IP address plan is as important as any other
Access Layer Design Option 2—Fixed Configuration Access Layer Network design aspect of the community college network to create an efficient, scalable, and
stable network design. Identifying an IP addressing strategy for the network for the entire
This entry-level access layer design option is widely chosen for educational community college network design is essential.
environments. The fixed configuration Cisco Catalyst switching portfolio supports a wide
Note This section does not explain the fundamentals of TCP/IP addressing; for more
range of access layer technologies that allow seamless service integration and enable
intelligent network management at the edge. details, see the many Cisco Press publications that cover this topic.
The fixed configuration Cisco Catalyst 3560-E Series is a commonly deployed platform The following are key benefits of using hierarchical IP addressing:
for wired network access that can be in a mixed configuration with critical devices such as
• Efficient address allocation
Cisco IP Phones and non-mission critical endpoints such as library PCs, printers, and so
on. For non-stop network operation during power outages, the Catalyst 3560-E must be – Hierarchical addressing provides the advantage of grouping all possible
deployed with an internal or external redundant power supply solution using the Cisco addresses contiguously.
RPS 2300. Increasing aggregated power capacity allows flexibility to scale power over – In non-contiguous addressing, a network can create addressing conflicts and
Ethernet (PoE) on a per-port basis. With its wire-speed 10G uplink forwarding capacity, overlapping problems, which may not allow the network administrator to use the
this design reduces network congestion and latency to significantly improve application complete address block.
performance.
Community College LAN Design SBA

• Improved routing efficiencies Routing Design Principles

– Building centralized main and remote college campus site networks with Although enabling routing functions in the core is a simple task, the routing blueprint must
contiguous IP addresses provides an efficient way to advertise summarized be well understood and designed before implementation, because it provides the
routes to neighbors. end-to-end reachability path of the college network. For an optimized routing design, the
– Route summarization simplifies the routing database and computation during following three routing components must be identified and designed to allow more
topology change events. network growth and provide a stable network, independent of scale:
– Reduces network bandwidth utilization used by routing protocols. • Hierarchical network addressing—Structured IP network addressing in the
community college LAN and/or WAN design is required to make the network
– Improves overall routing protocol performance by flooding less messages and
scalable, optimal, and resilient.
improves network convergence time.
• Routing protocol—Cisco IOS supports a wide range of Interior Gateway Protocols
• Improved system performance (IGPs). Cisco recommends deploying a single routing protocol across the community
– Reduces the memory needed to hold large-scale discontiguous and college network infrastructure.
non-summarized route entries. • Hierarchical routing domain—Routing protocols must be designed in a hierarchical
– Reduce higher CPU power to re-compute large-scale routing databases during model that allows the network to scale and operate with greater stability. Building a
topology change events. routing boundary and summarizing the network minimizes the topology size and
– Becomes easier to manage and troubleshoot. synchronization procedure, which improves overall network resource use and
re-convergence.
– Helps in overall network and system stability.

Network Foundational Technologies for LAN Design Routing Protocol Selection Criteria
The criteria for choosing the right protocol vary based on the end-to-end network
In addition to a hierarchical IP addressing scheme, it is also essential to determine which
infrastructure. Although all the routing protocols that Cisco IOS currently supports can
areas of the community college design are Layer 2 or Layer 3 to determine whether
provide a viable solution, network architects must consider all the following critical design
routing or switching fundamentals need to be applied. The following applies to the three
factors when selecting the right routing protocol to be implemented throughout the
layers in a LAN design model:
internal network:
• Core layer—Because this is a Layer 3 network that interconnects several remote
• Network design—Requires a proven protocol that can scale in full-mesh campus
locations and shared devices across the network, choosing a routing protocol is
network designs and can optimally function in hub-and-spoke WAN network
essential at this layer.
topologies.
• Distribution layer—The distribution block uses a combination of Layer 2 and Layer 3
• Scalability—The routing protocol function must be network- and system-efficient
switching to provide for the appropriate balance of policy and access controls,
and operate with a minimal number of updates and re-computation, independent of
availability, and flexibility in subnet allocation and VLAN usage. Both routing and
the number of routes in the network.
switching fundamentals need to be applied.
• Rapid convergence—Link-state versus DUAL re-computation and synchronization.
• Access layer—This layer is the demarcation point between network infrastructure
Network re-convergence also varies based on network design, configuration, and a
and computing devices. This is designed for critical network edge functions to
multitude of other factors that may be more than a specific routing protocol can
provide intelligent application and device-aware services, to set the trust boundary to
handle. The best convergence time can be achieved from a routing protocol if the
distinguish applications, provide identity-based network access to protected data
network is designed to the strengths of the protocol.
and resources, provide physical infrastructure services to reduce greenhouse
emission, and more. This subsection provides design guidance to enable various • Operational—A simplified routing protocol that can provide ease of configuration,
types of Layer 1 to 3 intelligent services, and to optimize and secure network edge management, and troubleshooting.
ports. Cisco IOS supports a wide range of routing protocols, such as Routing Information
The recommended routing or switching scheme of each layer is discussed in the Protocol (RIP) v1/2, Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest
following sections. Path First (OSPF), and Intermediate System-to-Intermediate System (IS-IS). However,
Cisco recommends using EIGRP or OSPF for this network design. EIGRP is a popular
Designing the Core Layer Network version of an Interior Gateway Protocol (IGP) because it has all the capabilities needed for
small to large-scale networks, offers rapid network convergence, and above all is simple
Because the core layer is a Layer 3 network, routing principles must be applied. Choosing to operate and manage. OSPF is popular link-state protocol for large-scale enterprise and
a routing protocol is essential, and routing design principles and routing protocol service provider networks. OSPF enforces hierarchical routing domains in two tiers by
selection criteria are discussed in the following subsections. implementing backbone and non-backbone areas. The OSPF area function depends on
the network connectivity model and the role of each OSPF router in the domain. OSPF can
scale higher but the operation, configuration, and management might become too
complex for the community college LAN network infrastructure.
Community College LAN Design SBA

Other technical factors must be considered when implementing OSPF in the network, Figure 25 Sample End-to-End EIGRP Routing Design in Community College LAN Network
such as OSPF router type, link type, maximum transmission unit (MTU) considerations,
designated router (DR)/backup designated router (BDR) priority, and so on. This Main Campus
document provides design guidance for using simplified EIGRP in the community college EIGRP
campus and WAN network infrastructure. AS 100

Note For detailed information on EIGRP and OSPF, see the following URL:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/routed-ex.ht
ml.
VSL

Designing an End-to-End EIGRP Routing Network

EIGRP is a balanced hybrid routing protocol that builds neighbor adjacency and flat
routing topology on a per autonomous system (AS) basis. Cisco recommends
considering the following three critical design tasks before implementing EIGRP in the
VSL
community college LAN core layer network:
• EIGRP autonomous system—The Layer 3 LAN and WAN infrastructure of the
community college design must be deployed in a single EIGRP AS, as shown in
Figure 25. A single EIGRP AS reduces operational tasks and prevents route
redistribution, loops, and other problems that may occur because of
misconfiguration.
QFP
EIGRP
AS 100
WAN

VSL

VSL

EIGRP EIGRP EIGRP

AS 100 AS 100 AS 100

228491
Remote Remote Remote
Large Campus Medium Campus Small Campus

In the example in Figure 25, AS100 is the single EIGRP AS for the entire design.
• EIGRP adjacency protection—This increases network infrastructure efficiency and
protection by securing the EIGRP adjacencies with internal systems. This task
involves two subset implementation tasks on each EIGRP-enabled network devices:
– Increases system efficiency—Blocks EIGRP processing with passive-mode
configuration on physical or logical interfaces connected to non- EIGRP devices
in the network, such as PCs. The best practice helps reduce CPU utilization and
secures the network with unprotected EIGRP adjacencies with untrusted
devices.
Community College LAN Design SBA

– Network security—Each EIGRP neighbor in the LAN/WAN network must be By default, EIGRP speakers transmit Hello packets every 5 seconds, and terminates
trusted by implementing and validating the Message-Digest algorithm 5 (MD5) EIGRP adjacency if the neighbor fails to receive it within 15 seconds of hold-down time. In
authentication method on each EIGRP-enabled system in the network. this network design, Cisco recommends retaining default EIGRP Hello and Hold timers on
• Optimizing EIGRP topology—EIGRP allows network administrators to summarize all EIGRP-enabled platforms.
multiple individual and contiguous networks into a single summary network before
advertising to the neighbor. Route summarization helps improve network Designing the Campus Distribution Layer Network
performance, stability, and convergence by hiding the fault of an individual network This section provides design guidelines for deploying various types of Layer 2 and Layer
that requires each router in the network to synchronize the routing topology. Each 3 technology in the distribution layer. Independent of which implemented distribution
aggregating device must summarize a large number of networks into a single layer design model is deployed, the deployment guidelines remain consistent in all
summary route. Figure 26 shows an example of the EIGRP topology for the designs.
community college LAN design.
Because the distribution layer can be deployed with both Layer 2 and Layer 3
Figure 26 EIGRP Route Aggregator Design technologies, the following two network designs are recommended:
Main Campus
• Multilayer
• Routed access
Access
Designing the Multilayer Network
A multilayer network is a traditional, simple, and widely deployed scenario, regardless of
network scale. The access layer switches in the campus network edge interface with
VSL various types of endpoints and provide intelligent Layer 1/2 services. The access layer
Aggregator Distribution
switches interconnect to distribution switches with the Layer 2 trunk, and rely on the
distribution layer aggregation switch to perform intelligent Layer 3 forwarding and to set
policies and access control.
There are the following three design variations to build a multilayer network; all variations
VSL Core
must be deployed in a V-shape physical network design and must be built to provide a
loop-free topology:
• Flat—Certain applications and user access requires that the broadcast domain
design span more than a single wiring closet switch. The multilayer network design
provides the flexibility to build a single large broadcast domain with an extended star
topology. Such flexibility introduces scalability, performance, and security
Aggregator
QFP WAN challenges, and may require extra attention to protect the network against
Edge
misconfiguration and miswiring that can create spanning-tree loops and de-stabilize
the network.
WAN
• Segmented—Provides a unique VLAN for different education divisions and college
business function segments to build a per-department logical network. All network
communication between education and administrative groups passes through the
routing and forwarding policies defined at the distribution layer.
Aggregator Aggregator
• Hybrid—A hybrid logical network design segments VLAN workgroups that do not
span different access layer switches, and allows certain VLANs (for example, that net
VSL management VLAN) to span across the access-distribution block. The hybrid
network design enables flat Layer 2 communication without impacting the network,
Aggregator and also helps reduce the number of subnets used.
Aggregator Figure 27 shows the three design variations for the multilayer network.

VSL
Aggregator
228492
Community College LAN Design SBA

Figure 27 Multilayer Design Variations Designing the Routed Access Network

Multi-Layer – Flat Network Multi-Layer –Segmented VLAN Multi-Layer – Hybrid Network Routing functions in the access layer network simplify configuration, optimize distribution
VSL VSL VSL
performances, and provide end-to-end troubleshooting tools. Implementing Layer 3
Single Root
Bridge functions in the access layer replaces Layer 2 trunk configuration to a single point-to-point
Layer 3 interface with a collapsed core system in the aggregation layer. Pushing Layer 3
V-Shape functions one tier down on Layer 3 access switches changes the traditional multilayer
Network
network topology and forwarding development path. Implementing Layer 3 functions in
Single Loop-free the access switch does not require any physical or logical link reconfiguration; the
Etherchannel
access-distribution block can be used, and is as resilient as in the multilayer network
design. Figure 29 shows the differences between the multilayer and routed access
Admin Library Arts Admin Library Arts Admin Library Arts
network designs, as well as where the Layer 2 and Layer 3 boundaries exist in each
VLAN VLAN VLAN VLAN VLAN VLAN VLAN VLAN VLAN network design.
10 10 10 10 20 30 10 20 30
Network Mangement Figure 29 Layer 2 and Layer 3 Boundaries for Multilayer and Routed Access Network Design

228493
VLAN 90
VSL VSL
Core Core
Cisco recommends that the hybrid multilayer access-distribution block design use a
loop-free network topology, and span a few VLANs that require such flexibility, such as the
management VLAN.
Routing Routing
Ensuring a loop-free topology is critical in a multilayer network design. Spanning-Tree
VSL Layer 3 VSL Layer 3
Protocol (STP) dynamically develops a loop-free multilayer network topology that can
Distribution Distribution
compute the best forwarding path and provide redundancy. Although STP behavior is
deterministic, it is not optimally designed to mitigate network instability caused by
hardware miswiring or software misconfiguration. Cisco has developed several STP
STP Routing
extensions to protect against network malfunctions, and to increase stability and
Layer 2
availability. All Cisco Catalyst LAN switching platforms support the complete STP toolkit Access Access
suite that must be enabled globally on individual logical and physical ports of the Layer 2
distribution and access layer switches. Admin Library Arts Admin Library Arts
VLAN VLAN VLAN VLAN VLAN VLAN
Figure 28 shows an example of enabling various STP extensions on distribution and 10 20 30 10 20 30

access layer switches in all campus sites. Multi-Layer Network Routed-Access Network

228467
Figure 28 Protecting Multilayer Network with Cisco STP Toolkit Routed-access network design enables Layer 3 access switches to perform Layer 2
demarcation point and provide Inter-VLAN routing and gateway function to the endpoints.
VSL The Layer 3 access switches makes more intelligent, multi-function and policy-based
STP Root Bridge
routing and switching decision like distribution-layer switches.
Although Cisco VSS and a single redundant distribution design are simplified with a
Root Guard UDLD single point-to-point EtherChannel, the benefits in implementing the routed access
design in community colleges are as follows:
UDLD
• Eliminates the need for implementing STP and the STP toolkit on the distribution
system. As a best practice, the STP toolkit must be hardened at the access layer.
• Shrinks the Layer 2 fault domain, thus minimizing the number of denial-of-service
(DoS)/ distributed denial-of-service (DDoS) attacks.
BPDU Guard • Bandwidth efficiency—Improves Layer 3 uplink network bandwidth efficiency by
suppressing Layer 2 broadcasts at the edge port.
228494

Library
Layer 2 Port • Improves overall collapsed core and distribution resource utilization.
Note For additional STP information, see the following URL: Enabling Layer 3 functions in the access-distribution block must follow the same core
http://www.cisco.com/en/US/tech/tk389/tk621/tsd_technology_support_troubl network designs as mentioned in previous sections to provide network security as well as
eshooting_technotes_list.html. optimize the network topology and system resource utilization:
Community College LAN Design SBA

• EIGRP autonomous system—Layer 3 access switches must be deployed in the Multicast for Application Delivery
same EIGRP AS as the distribution and core layer systems.
Because unicast communication is based on the one-to-one forwarding model, it
• EIGRP adjacency protection—EIGRP processing must be enabled on uplink Layer 3 becomes easier in routing and switching decisions to perform destination address
EtherChannels, and must block remaining Layer 3 ports by default in passive mode. lookup, determine the egress path by scanning forwarding tables, and to switch traffic. In
Access switches must establish secured EIGRP adjacency using the MD5 hash the unicast routing and switching technologies discussed in the previous section, the
algorithm with the aggregation system. network may need to be made more efficient by allowing certain applications where the
• EIGRP network boundary—All EIGRP neighbors must be in a single AS to build a same content or application must be replicated to multiple users. IP multicast delivers
common network topology. The Layer 3 access switches must be deployed in EIGRP source traffic to multiple receivers using the least amount of network resources as
stub mode for a concise network view. possible without placing an additional burden on the source or the receivers. Multicast
packet replication in the network is done by Cisco routers and switches enabled with
Designing the Layer 3 Access Layer Protocol Independent Multicast (PIM) as well as other multicast routing protocols.
EIGRP creates and maintains a single flat routing topology network between EIGRP peers. Similar to the unicast methods, multicast requires the following design guidelines:
Building a single routing domain in a large-scale campus core design allows for complete • Choosing a multicast addressing design
network visibility and reachability that may interconnect multiple campus components, • Choosing a multicast routing protocol
such as distribution blocks, services blocks, the data center, the WAN edge, and so on.
• Providing multicast security regardless of the location within the community college
In the three- or two-tier deployment models, the Layer 3 access switch must always have design
single physical or logical forwarding to a distribution switch. The Layer 3 access switch
dynamically develops the forwarding topology pointing to a single distribution switch as a Multicast Addressing Design
single Layer 3 next hop. Because the distribution switch provides a gateway function to
rest of the network, the routing design on the Layer 3 access switch can be optimized with The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast
the following two techniques to improve performance and network reconvergence in the addresses. A range of class D address space is assigned to be used for IP multicast
access-distribution block, as shown in Figure 30: applications. All multicast group addresses fall in the range from 224.0.0.0 through
• Deploying the Layer 3 access switch in EIGRP stub mode 239.255.255.255. Layer 3 addresses in multicast communications operate differently;
while the destination address of IP multicast traffic is in the multicast group range, the
• Summarizing the network view with a default route to the Layer 3 access switch for source IP address is always in the unicast address range. Multicast addresses are
intelligent routing functions assigned in various pools for well-known multicast-based network protocols or
Figure 30 Designing and Optimizing EIGRP Network Boundary for the Access Layer inter-domain multicast communications, as listed in Table 2.

EIGRP Stub Network Summarized EIGRP Route Advertisment

Table 2 Multicast Address Range Assignments
VSL VSL
Application Address Range
Reserved—Link local network protocols. 224.0.0.0/24
EIGRP
AS-100 Global scope—Group communication between an organization 224.0.1.0 – 238.255.255.255
and the Internet.
VSL VSL
Summarized Aggregator Source Specific Multicast (SSM)—PIM extension for one-to-many 232.0.0.0/8
Network unidirectional multicast communication.

Non-Summarized
Summarized Network GLOP—Inter-domain multicast group assignment with reserved 233.0.0.0/8
+ Default Network
Connected global AS.
Network
Limited scope—Administratively scoped address that remains 239.0.0.0/8
EIGRP EIGRP
Stub AS-100 constrained within a local organization or AS. Commonly deployed
Mode in enterprise, education, and other organizations.
Admin Library Arts Admin Library Arts
VLAN VLAN VLAN VLAN VLAN VLAN
10 20 30 10 20 30
Routed-Access Network Routed-Access Network During the multicast network design phase, community college network architects must
228495

select a range of multicast sources from the limited scope pool (239/8).
Community College LAN Design SBA

Multicast Routing Design PIM-SM RP Placement Best Practices

To enable end-to-end dynamic multicast operation in the network, each intermediate It is assumed that each community college site has a wide range of local multicast sources
system between the multicast receiver and source must support the multicast feature. in the data center for distributed community college IT-managed media and student
Multicast develops the forwarding table differently than the unicast routing and switching research and development applications. In such a distributed multicast network design,
model. To enable communication, multicast requires specific multicast routing protocols Cisco recommends deploying PIM RP on each site for wired or wireless multicast
and dynamic group membership. receivers and sources to join and register at the closest RP. The community college
reference design recommends PIM-SM RP placement on a VSS-enabled and single
Multicast Routing Protocol Design resilient core system in the three-tier campus design, or on the collapsed
core/distribution system in the two-tier campus design model.
The community college LAN design must be able to build packet distribution trees that
specify a unique forwarding path between the subnet of the source and each subnet PIM-SM RP Mode Best Practices
containing members of the multicast group. A primary goal in distribution trees
construction is to ensure that no more than one copy of each packet is forwarded on each PIM-SM supports RP deployment in the following three modes in the network:
branch of the tree. The two basic types of multicast distribution trees are as follows: • Static—In this mode, RP must be statically identified and configured on each PIM
• Source trees—The simplest form of a multicast distribution tree is a source tree, with router in the network. RP load balancing and redundancy can be achieved using
its root at the source and branches forming a tree through the network to the anycast RP.
receivers. Because this tree uses the shortest path through the network, it is also • Auto-RP—This mode is a dynamic method for discovering and announcing the RP in
referred to as a shortest path tree (SPT). the network. Auto-RP implementation is beneficial when there are multiple RPs and
• Shared trees—Unlike source trees that have their root at the source, shared trees groups that often change in the network. To prevent network reconfiguration during a
use a single common root placed at a selected point in the network. This shared root change, the RP mapping agent router must be designated in the network to receive
is called a rendezvous point (RP). RP group announcements and to arbitrate conflicts, as part of the PIM version 1
specification.
The PIM protocol is divided into the following two modes to support both types of
multicast distribution trees: • BootStrap Router (BSR)—This mode performs the same tasks as Auto-RP but in a
different way, and is part of the PIM version 2 specification. Auto-RP and BSR cannot
• Dense mode (DM)—Assumes that almost all routers in the network need to distribute
co-exist or interoperate in the same network.
multicast traffic for each multicast group (for example, almost all hosts on the network
belong to each multicast group). PIM in DM mode builds distribution trees by initially In a small to mid-sized multicast network, static RP configuration is recommended over
flooding the entire network and then pruning back the small number of paths without the other modes. Static RP implementation offers RP redundancy and load sharing, and
receivers. an additional simple access control list (ACL) can be applied to deploy RP without
compromising multicast network security. Cisco recommends designing the community
• Sparse mode (SM)—Assumes that relatively few routers in the network are involved
college LAN multicast network using the static PIM-SM mode configuration.
in each multicast. The hosts belonging to the group are widely dispersed, as might be
the case for most multicasts over the WAN. Therefore, PIM-SM begins with an empty
distribution tree and adds branches only as the result of explicit Internet Group PIM-SM RP Redundancy Best Practices
Management Protocol (IGMP) requests to join the distribution. PIM-SM mode is ideal PIM-SM RP redundancy and load sharing becomes imperative in the community college
for a network without dense receivers and multicast transport over WAN LAN design, because each recommended core layer design model provides resiliency
environments, and it adjusts its behavior to match the characteristics of each receiver and simplicity. In the Cisco Catalyst 6500 VSS-enabled core layer, the dynamically
group. discovered group-to-RP entries are fully synchronized to the standby switch. Combining
Selecting the PIM mode depends on the multicast applications that use various NSF/SSO capabilities with IPv4 multicast reduces the network recovery time and retains
mechanisms to build multicast distribution trees. Based on the multicast scale factor and the user and application performance at an optimal level. In the non-VSS-enabled network
centralized source deployment design for one-to-many multicast communication in design, PIM-SM uses Anycast RP and Multicast Source Discovery Protocol (MSDP) for
community college LAN infrastructures, Cisco recommends deploying PIM-SM because node failure protection. PIM-SM redundancy and load sharing is simplified with the Cisco
it is efficient and intelligent in building multicast distribution tree. All the recommended VSS-enabled core. Because VSS is logically a single system and provides node
platforms in this design support PIM-SM mode on physical or logical (switched virtual protection, there is no need to implement Anycast RP and MSDP on a VSS-enabled
interface [SVI] and EtherChannel) interfaces. PIM-SM RP.

Designing PIM Rendezvous Point Inter-Site PIM RP Best Practices

The following sections discuss best practices in designing the PIM RP. MSDP allows PIM RPs to share information about the active sources. PIM-SM RPs
discover local receivers through PIM join messages, while the multicast source can be in
a local or remote network domain. MSDP allows each multicast domain to maintain an
Community College LAN Design SBA

independent RP that does not rely on other multicast domains, but does enable RPs to The multicast system role changes when the access layer is deployed in the multilayer
forward traffic between domains. PIM-SM is used to forward the traffic between the and routed access models. Because multilayer access switches do not run PIM, it
multicast domains. becomes complex to make forwarding decisions out of the receiver port. In such a
Anycast RP is a useful application of MSDP. Originally developed for interdomain situation, Layer 2 access switches flood the traffic on all ports. This multilayer limitation in
multicast applications, MSDP used with Anycast RP is an intradomain feature that access switches is solved by using the IGMP snooping feature, which is enabled by
provides redundancy and load sharing capabilities. Large networks typically use Anycast default and is recommended to not be disabled.
RP for configuring a PIM-SM network to meet fault tolerance requirements within a single IGMP is still required when a Layer 3 access layer switch is deployed in the routed access
multicast domain. network design. Because the Layer 3 boundary is pushed down to the access layer, IGMP
The community college LAN multicast network must be designed with Anycast RP. communication is limited between a receiver host and the Layer 3 access switch. In
PIM-SM RP at the main or the centralized core must establish an MSDP session with RP addition to the unicast routing protocol, PIM-SM must be enabled at the Layer 3 access
on each remote site to exchange distributed multicast source information and allow RPs switch to communicate with RPs in the network.
to join SPT to active sources as needed. Figure 31 shows an example of a community
college LAN multicast network design. Designing Multicast Security

Figure 31 Community College LAN Multicast Network Design When designing multicast security in the community college LAN design, two key
concerns are preventing a rogue source and preventing a rogue PIM-RP.
CCVE PIM-SM Network Design
Main Campus
Preventing Rogue Source
PIM-SM Access
In a PIM-SM network, an unwanted traffic source can be controlled with the pim
accept-register command. When the source traffic hits the first-hop router, the first-hop
VSL router (DR) creates the (S,G) state and sends a PIM source register message to the RP. If
Distribution
PIM-SM the source is not listed in the accept-register filter list (configured on the RP), the RP
rejects the register and sends back an immediate Register-Stop message to the DR. The
PIM-SM RP Inter-Site Multicast Network Design drawback with this method of source filtering is that with the pim accept-register
VSL Core
Main Campus
command on the RP, the PIM-SM (S,G) state is still created on the first-hop router of the
PIM-SM
source. This can result in traffic reaching receivers local to the source and located
PIM-SM VSL between the source and the RP. Furthermore, because the pim accept-register command
PIM-SM
works on the control plane of the RP, this can be used to overload the RP with fake register
QFP WAN
Edge PIM-SM RP messages and possibly cause a DoS condition.
WAN
MSDP Peering PIM-SM
Anycast RP Preventing Rogue PIM-RP
PIM-SM PIM-SM
Like the multicast source, any router can be misconfigured or can maliciously advertise
Aggregator PIM-SM RP
VSL
itself as a multicast RP in the network with the valid multicast group address. With a static
RP configuration, each PIM-enabled router in the network can be configured to use static
VSL
PIM-SM RP
PIM-SM RP PIM-SM RP
RP for the multicast source and override any other Auto-RP or BSR multicast router
PIM-SM RP
PIM-SM
PIM-SM RP Remote Remote Remote
announcement from the network.
Large Campus Medium Campus Small Campus

VSL QoS for Application Performance Optimization

PIM-SM
The function and guaranteed low latency bandwidth expectation of network users and
endpoints has evolved significantly over the past few years. Application and device
228496

Remote Remote Remote

Large Campus Medium Campus Small Campus
awareness has become a key tool in providing differentiated service treatment at the
campus LAN edge. Media applications, and particularly video-oriented media
applications, are evolving as the education community enters the digital era of delivering
Dynamic Group Membership Design education, as well as the increased campus network and asset security requirements.
Multicast receiver registration is done via IGMP protocol signaling. IGMP is an integrated Integrating video applications in the community college LAN network exponentially
component of an IP multicast framework that allows the receiver hosts and transmitting increases bandwidth utilization and fundamentally shifts traffic patterns. Business drivers
sources to be dynamically added to and removed from the network. Without IGMP, the behind this media application growth include remote learning, as well as leveraging the
network is forced to flood rather than multicast the transmissions for each group. IGMP network as a platform to build an energy-efficient network to minimize cost and go “green”.
operates between a multicast receiver host in the access layer and the Layer 3 router at High-definition media is transitioning from the desktop to conference rooms, and social
the distribution layer.
Community College LAN Design SBA

networking phenomena are crossing over into educational settings. Besides internal and Figure 32 Community College LAN Campus 12-Class QoS Policy Recommendation
college research applications, media applications are fueling a new wave of IP
convergence, requiring the ongoing development of converged network designs. Application Class Media Application Examples PHB
Admission
Control
Queuing and Dropping

Converging media applications onto an IP network is much more complex than Required
VoIP Telephony Cisco IP Phone EF Priority Queue (PQ)
converging voice over IP (VoIP) alone. Media applications are generally
bandwidth-intensive and bursty (as compared to VoIP), and many different types of media Broadcast Video Cisco IPVS, Enterprise TV CS5 Required (Optional) PQ

applications exist; in addition to IP telephony, applications can include live and Real-Time Interactive Cisco TelePresence CS4 Required (Optional) PQ
on-demand streaming media applications, digital signage applications, high-definition
Multimedia Conferencing Cisco CUPC, WebEx AF4 Required BW Queue + DSCP WRED
room-based conferencing applications, as well as an infinite array of data-oriented
applications. By embracing media applications as the next cycle of convergence, Multimedia Streaming Cisco DMS, IP/TV AF3 Recommended BW Queue + DSCP WRED
community college IT departments can think holistically about their network design and
Network Control EIGRP, OSPF, HSRP, IKE CS6 BW Queue
its readiness to support the coming tidal wave of media applications, and develop a
network-wide strategy to ensure high quality end-user experiences. Call-Signaling SCCP, SIP, H.323 CS3 BW Queue

The community college LAN infrastructure must set the administrative policies to provide Ops/Admin/Mgmt (OAM) SNMP, SSH, Syslog CS2 BW Queue
differentiated forwarding services to the network applications, users and endpoints to Transactional Data ERP Apps, CRM Apps AF2 BW Queue + DSCP WRED
prevent contention. The characteristic of network services and applications must be well
Bulk Data E-mail, FTP, Backup AF1 BW Queue + DSCP WRED
understood, so that policies can be defined that allow network resources to be used for
internal applications, to provide best-effort services for external traffic, and to keep the Best Effort Default Class DF Default Queue + RED

228497
network protected from threats. Scavenger YouTube, Gaming, P2P CS1 Min BW Queue

The policy for providing network resources to an internal application is further

complicated when interactive video and real-time VoIP applications are converged over The twelve classes are as follows:
the same network that is switching mid-to-low priority data traffic. Deploying QoS • VoIP telephony—This service class is intended for VoIP telephony (bearer-only)
technologies in the campus allows different types of traffic to contend inequitably for traffic (VoIP signaling traffic is assigned to the call-signaling class). Traffic assigned to
network resources. Real-time applications such as voice, interactive, and physical security this class should be marked EF. This class is provisioned with expedited forwarding
video can be given priority or preferential services over generic data applications, but not (EF) per-hop behavior (PHB). The EF PHB-defined in RFC 3246 is a strict-priority
to the point that data applications are starving for bandwidth. queuing service and, as such, admission to this class should be controlled (admission
control is discussed in the following section). Examples of this type of traffic include
Community College LAN QoS Framework G.711 and G.729a.
Each group of managed and un-managed applications with unique traffic patterns and • Broadcast video—This service class is intended for broadcast TV, live events, video
service level requirements requires a dedicated QoS class to provision and guarantee surveillance flows, and similar inelastic streaming video flows, which are highly drop
these service level requirements. The community college LAN network architect may sensitive and have no retransmission and/or flow control capabilities. Traffic in this
need to determine the number of classes for various applications, as well as how should class should be marked class selector 5 (CS5) and may be provisioned with an EF
these individual classes should be implemented to deliver differentiated services PHB; as such, admission to this class should be controlled. Examples of this traffic
consistently in main and remote college campus sites. Cisco recommends following include live Cisco Digital Media System (DMS) streams to desktops or to Cisco Digital
relevant industry standards and guidelines whenever possible, to extend the Media Players (DMPs), live Cisco Enterprise TV (ETV) streams, and Cisco IP Video
effectiveness of your QoS policies beyond your direct administrative control. Surveillance.
With minor changes, the community college LAN QoS framework is developed based on • Real-time interactive—This service class is intended for (inelastic) room-based,
RFC4594 that follows industry standard and guidelines to function consistently in high-definition interactive video applications and is intended primarily for voice and
heterogeneous network environment. These guidelines are to be viewed as industry video components of these applications. Whenever technically possible and
best-practice recommendations. Community college and service providers are administratively feasible, data sub-components of this class can be separated out
encouraged to adopt these marking and provisioning recommendations, with the aim of and assigned to the transactional data traffic class. Traffic in this class should be
improving QoS consistency, compatibility, and interoperability. However, because these marked CS4 and may be provisioned with an EF PHB; as such, admission to this class
guidelines are not standards, modifications can be made to these recommendations as should be controlled. A sample application is Cisco TelePresence.
specific needs or constraints require. To this end, to meet specific business requirements, • Multimedia conferencing—This service class is intended for desktop software
Cisco has made a minor modification to its adoption of RFC 4594, namely the switching of multimedia collaboration applications and is intended primarily for voice and video
call-signaling and broadcast video markings (to CS3 and CS5, respectively). components of these applications. Whenever technically possible and
RFC 4594 outlines twelve classes of media applications that have unique service level administratively feasible, data sub-components of this class can be separated out
requirements, as shown in Figure 32. and assigned to the transactional data traffic class. Traffic in this class should be
marked assured forwarding (AF) Class 4 (AF41) and should be provisioned with a
guaranteed bandwidth queue with Differentiated Services Code Point
Community College LAN Design SBA

(DSCP)-based Weighted Random Early Detection (WRED) enabled. Admission to this DSCP-WRED enabled. This traffic class may be subject to policing and re-marking.
class should be controlled; additionally, traffic in this class may be subject to policing Sample applications include E-mail, backup operations, FTP/SFTP transfers, video
and re-marking. Sample applications include Cisco Unified Personal Communicator, and content distribution, and so on.
Cisco Unified Video Advantage, and the Cisco Unified IP Phone 7985G. • Best effort (or default class)—This service class is the default class. The vast majority
• Multimedia streaming—This service class is intended for video-on-demand (VoD) of applications will continue to default to this best-effort service class; as such, this
streaming video flows, which, in general, are more elastic than broadcast/live default class should be adequately provisioned. Traffic in this class is marked default
streaming flows. Traffic in this class should be marked AF Class 3 (AF31) and should forwarding (DF or DSCP 0) and should be provisioned with a dedicated queue. WRED
be provisioned with a guaranteed bandwidth queue with DSCP-based WRED is recommended to be enabled on this class.
enabled. Admission control is recommended on this traffic class (though not strictly • Scavenger (or low-priority data)—This service class is intended for
required) and this class may be subject to policing and re-marking. Sample non-business-related traffic flows, such as data or video applications that are
applications include Cisco Digital Media System VoD streams. entertainment and/or gaming-oriented. The approach of a less-than Best-Effort
• Network control—This service class is intended for network control plane traffic, service class for non-business applications (as opposed to shutting these down
which is required for reliable operation of the enterprise network. Traffic in this class entirely) has proven to be a popular, political compromise. These applications are
should be marked CS6 and provisioned with a (moderate, but dedicated) guaranteed permitted on enterprise networks, as long as resources are always available for
bandwidth queue. WRED should not be enabled on this class, because network business-critical voice, video, and data applications. However, as soon as the network
control traffic should not be dropped (if this class is experiencing drops, the experiences congestion, this class is the first to be penalized and aggressively
bandwidth allocated to it should be re-provisioned). Sample traffic includes EIGRP, dropped. Traffic in this class should be marked CS1 and should be provisioned with
OSPF, Border Gateway Protocol (BGP), HSRP, Internet Key Exchange (IKE), and so on. a minimal bandwidth queue that is the first to starve should network congestion
• Call-signaling—This service class is intended for signaling traffic that supports IP occur. Sample traffic includes YouTube, Xbox Live/360 movies, iTunes, BitTorrent,
voice and video telephony. Traffic in this class should be marked CS3 and and so on.
provisioned with a (moderate, but dedicated) guaranteed bandwidth queue. WRED
should not be enabled on this class, because call-signaling traffic should not be Designing Community College LAN QoS Trust Boundary and Policies
dropped (if this class is experiencing drops, the bandwidth allocated to it should be To build an end-to-end QoS framework that offers transparent and consistent QoS
re-provisioned). Sample traffic includes Skinny Call Control Protocol (SCCP), Session service without compromising performance, it is important to create an blueprint of the
Initiation Protocol (SIP), H.323, and so on. network, classifying a set of trusted applications, devices, and forwarding paths; and then
• Operations/administration/management (OAM)—This service class is intended for define common QoS policy settings independent of how QoS is implemented within the
network operations, administration, and management traffic. This class is critical to system.
the ongoing maintenance and support of the network. Traffic in this class should be QoS settings applied at the LAN network edge sets the ingress rule based on deep packet
marked CS2 and provisioned with a (moderate, but dedicated) guaranteed classification and marks the traffic before it is forwarded inside the campus core. To retain
bandwidth queue. WRED should not be enabled on this class, because OAM traffic the marking set by access layer switches, it is important that other LAN network devices in
should not be dropped (if this class is experiencing drops, the bandwidth allocated to the college campus trust the marking and apply the same policy to retain the QoS settings
it should be re-provisioned). Sample traffic includes Secure Shell (SSH), Simple and offer symmetric treatment. Bi-directional network communication between
Network Management Protocol (SNMP), Syslog, and so on. applications, endpoints, or other network devices requires the same treatment when
• Transactional data (or low-latency data)—This service class is intended for traffic enters or leaves the network, and must be taken into account when designing the
interactive, “foreground” data applications (foreground refers to applications from trust model between network endpoints and core and edge campus devices.
which users are expecting a response via the network to continue with their tasks; The trust or un-trust model simplifies the rules for defining bi-directional QoS policy
excessive latency directly impacts user productivity). Traffic in this class should be settings. Figure 33 shows the QoS trust model setting that sets the QoS implementation
marked AF Class 2 (AF21) and should be provisioned with a dedicated bandwidth guidelines in community college campus networks.
queue with DSCP-WRED enabled. This traffic class may be subject to policing and
re-marking. Sample applications include data components of multimedia
collaboration applications, Enterprise Resource Planning (ERP) applications,
Customer Relationship Management (CRM) applications, database applications, and
so on.
• Bulk data (or high-throughput data)—This service class is intended for
non-interactive “background” data applications (background refers to applications
from which users are not awaiting a response via the network to continue with their
tasks; excessive latency in response times of background applications does not
directly impact user productivity). Traffic in this class should be marked AF Class 1
(AF11) and should be provisioned with a dedicated bandwidth queue with
Community College LAN Design SBA

Figure 33 Campus QoS Trust and Policies Classification and Marking Best Practices
When classifying and marking traffic, a recommended design principle is to classify and
VSL mark applications as close to their sources as technically and administratively feasible.
This principle promotes end-to-end differentiated services and PHBs.
Classification, In general, it is not recommended to trust markings that can be set by users on their PCs
Marking and or other similar devices, because users can easily abuse provisioned QoS policies if
Queueing permitted to mark their own traffic. For example, if an EF PHB has been provisioned over
Trust
the network, a PC user can easily configure all their traffic to be marked to EF, thus
VSL
hijacking network priority queues to service non-realtime traffic. Such abuse can easily
ruin the service quality of realtime applications throughout the college campus. On the
Classification,
Marking and other hand, if community college network administrator controls are in place that centrally
Trust administer PC QoS markings, it may be possible and advantageous to trust these.
Queueing

Queueing and WTD

Following this rule, it is recommended to use DSCP markings whenever possible,
Trust
because these are end-to-end, more granular, and more extensible than Layer 2
markings. Layer 2 markings are lost when the media changes (such as a
Trust, Classification, LAN-to-WAN/VPN edge). There is also less marking granularity at Layer 2. For example,
Marking, Policing Queueing and WTD 802.1P supports only three bits (values 0–7), as does Multiprotocol Label Switching
and Queueing Experimental (MPLS EXP). Therefore, only up to eight classes of traffic can be supported
at Layer 2, and inter-class relative priority (such as RFC 2597 Assured Forwarding Drop
IP Preference markdown) is not supported. Layer 3-based DSCP markings allow for up to 64
classes of traffic, which provides more flexibility and is adequate in large-scale
deployments and for future requirements.
As the network border blurs between enterprise and education community network and
service providers, the need for interoperability and complementary QoS markings is
Trusted, Conditional-Trusted or Un-Trusted Endpoints
critical. Cisco recommends following the IETF standards-based DSCP PHB markings to
ensure interoperability and future expansion. Because the community college voice,
228498 video, and data applications marking recommendations are standards-based, as
QoSTrust Boundary Ingress QoS Ploicy Egress QoS Ploicy
previously discussed, community colleges can easily adopt these markings to interface
with service provider classes of service.

Community College LAN QoS Best Practices

Policing and Markdown Best Practices
With an overall application strategy in place, end-to-end QoS policies can be designed for There is little reason to forward unwanted traffic that gets policed and drop by a
each device and interface, as determined by their roles in the network infrastructure. subsequent tier node, especially when unwanted traffic is the result of DoS or worm
However, because the Cisco QoS toolset provides many QoS design and deployment attacks in the college network. Excessive volume attack traffic can destabilize network
options, a few succinct design principles can help simplify strategic QoS deployments, as systems, which can result in outages. Cisco recommends policing traffic flows as close to
discussed in the following sections. their sources as possible. This principle applies also to legitimate flows, because
worm-generated traffic can masquerade under legitimate, well-known TCP/UDP ports
Hardware versus Software QoS and cause extreme amounts of traffic to be poured into the network infrastructure. Such
A fundamental QoS design principle is to always enable QoS policies in hardware rather excesses should be monitored at the source and marked down appropriately.
than software whenever possible. Cisco IOS routers perform QoS in software, which Whenever supported, markdown should be done according to standards-based rules,
places incremental loads on the CPU, depending on the complexity and functionality of such as RFC 2597 (AF PHB). For example, excess traffic marked to AFx1 should be marked
the policy. Cisco Catalyst switches, on the other hand, perform QoS in dedicated down to AFx2 (or AFx3 whenever dual-rate policing such as defined in RFC 2698 is
hardware application-specific integrated circuits (ASICs) on Ethernet-based ports, and as supported). Following such markdowns, congestion management policies, such as
such do not tax their main CPUs to administer QoS policies. This allows complex policies DSCP-based WRED, should be configured to drop AFx3 more aggressively than AFx2,
to be applied at line rates even up to Gigabit or 10-Gigabit speeds. which in turn should be dropped more aggressively than AFx1.
Community College LAN Design SBA

Queuing and Dropping Best Practices It is vitally important to understand that this strict priority queuing rule is simply a best
Critical media applications require uncompromised performance and service guarantees practice design recommendation and is not a mandate. There may be cases where
regardless of network conditions. Enabling outbound queueing in each network tier specific business objectives cannot be met while holding to this recommendation. In such
provides end-to-end service guarantees during potential network congestion. This cases, the community college network administrator must provision according to their
common principle applies to campus-to-WAN/Internet edges, where speed mismatches detailed requirements and constraints. However, it is important to recognize the tradeoffs
are most pronounced; and campus interswitch links, where oversubscription ratios create involved with over-provisioning strict priority traffic and its negative performance impact,
the greater potential for network congestion. both on other realtime flows and also on non-realtime-application response times.
Because each application class has unique service level requirements, each should be And finally, any traffic assigned to a strict-priority queue should be governed by an
assigned optimally a dedicated queue. A wide range of platforms in varying roles exist in admission control mechanism.
community college networks, so each must be bounded by a limited number of hardware
or service provider queues. No fewer than four queues are required to support QoS Best Effort Queuing Recommendation
policies for various types of applications, specifically as follows: The best effort class is the default class for all traffic that has not been explicitly assigned
• Realtime queue (to support a RFC 3246 EF PHB service) to another application-class queue. Only if an application has been selected for
• Guaranteed-bandwidth queue (to support RFC 2597 AF PHB services) preferential/deferential treatment is it removed from the default class. Because most
community colleges may have several types of applications running in networks,
• Default queue (to support a RFC 2474 DF service) adequate bandwidth must be provisioned for this class as a whole to handle the number
• Bandwidth-constrained queue (to support a RFC 3662 scavenger service) and volume of applications that default to it. Therefore, Cisco recommends reserving at
Additional queuing recommendations for these classes are discussed next. least 25 percent of link bandwidth for the default best effort class.

Strict-Priority Queuing Recommendations Scavenger Class Queuing Recommendations

The realtime or strict priority class corresponds to the RFC 3246 EF PHB. The amount of Whenever the scavenger queuing class is enabled, it should be assigned a minimal
bandwidth assigned to the realtime queuing class is variable. However, if the majority of amount of link bandwidth capacity, such as 1 percent, or whatever the minimal bandwidth
bandwidth is provisioned with strict priority queuing (which is effectively a FIFO queue), allocation that the platform supports. On some platforms, queuing distinctions between
the overall effect is a dampening of QoS functionality, both for latency- and jitter-sensitive bulk data and scavenger traffic flows cannot be made, either because queuing
realtime applications (contending with each other within the FIFO priority queue), and also assignments are determined by class of service (CoS) values (and both of these
for non-realtime applications (because these may periodically receive significant application classes share the same CoS value of 1), or because only a limited amount of
bandwidth allocation fluctuations, depending on the instantaneous amount of traffic being hardware queues exist, precluding the use of separate dedicated queues for each of
serviced by the priority queue). Remember that the goal of convergence is to enable these two classes. In such cases, the scavenger/bulk queue can be assigned a moderate
voice, video, and data applications to transparently co-exist on a single community amount of bandwidth, such as 5 percent.
college network infrastructure. When realtime applications dominate a link, non-realtime These queuing rules are summarized in Figure 34, where the inner pie chart represents a
applications fluctuate significantly in their response times, destroying the transparency of hardware or service provider queuing model that is limited to four queues and the outer
the converged network. pie chart represents a corresponding, more granular queuing model that is not bound by
For example, consider a 45 Mbps DS3 link configured to support two Cisco TelePresence such constraints.
CTS-3000 calls with an EF PHB service. Assuming that both systems are configured to
support full high definition, each such call requires 15 Mbps of strict-priority queuing.
Before the TelePresence calls are placed, non-realtime applications have access to 100
percent of the bandwidth on the link; to simplify the example, assume there are no other
realtime applications on this link. However, after these TelePresence calls are established,
all non-realtime applications are suddenly contending for less than 33 percent of the link.
TCP windowing takes effect and many applications hang, timeout, or become stuck in a
non-responsive state, which usually translates into users calling the IT help desk to
complain about the network (which happens to be functioning properly, albeit in a
poorly-configured manner).
Note As previously discussed, Cisco IOS software allows the abstraction (and thus
configuration) of multiple strict priority LLQs. In such a multiple LLQ context, this
design principle applies to the sum of all LLQs to be within one-third of link
capacity.
Community College LAN Design SBA

Figure 34 Compatible 4-Class and 12-Class Queuing Models • Device resiliency—Protects the network during abnormal node failure triggered by
hardware or software, such as software crashes, a non-responsive supervisor, and so
VoIP
Telephony
on.
• Operational resiliency—Enables resiliency capabilities to the next level, providing
Best complete network availability even during planned network outage conditions, using
Effort Broadcast In Service Software Upgrade (ISSU) features.
Video
Community College LAN Design High-Availability Framework
This high availability framework is based on the three major resiliency strategies
Best > described in the previous section. Several high availability technologies must be
Effort Realtime deployed at each layer to provide higher network availability and rapid recovery during
Realtime failure conditions, to prevent communication failure or degraded network-wide
Scavenger Scavenger Interactive application performance. (See Figure 35.)
Bulk Data Guaranteed BW Figure 35 Community College LAN Design High-Availability Goals, Strategy, and Technologies

Resilient Network Service Availability

Goal

Transactional Multimedia Resilient Network Device Operational

Data Conferencing Strategies Resiliency Resiliency Resiliency

OAM

228499
Signaling Network Multimedia EtherChannel/MEC
Control Streaming NSF/SSO ISSU
Resilient
Technologies UDLD
Stack Wise eFSU
IP Event Dampening

228500
High-Availability in LAN Network Design
Network reliability and availability is not a new demand, but is well planned during the early
network design phase. To prevent a catastrophic network failure during an unplanned Network Resiliency Best Practices
network outage event, it is important to identify network fault domains and define rapid
recovery plans to minimize the application impact during minor and major network outage The most common network fault occurrence in the LAN network is a link failure between
conditions. two systems. Link failures can be caused by issues such as a fiber cut, miswiring, and so
on. Redundant parallel physical links between two systems can increase availability, but
Because every tier of the LAN network design can be classified as a fault domain,
also change how overall higher layer protocols construct the adjacency and loop-free
deploying redundant systems can be effective. However, this introduces a new set of
forwarding topology to the parallel physical paths.
challenges, such as higher cost and the added complexity of managing more systems.
Network reliability and availability can be simplified using several Cisco high availability Deploying redundant parallel paths in the recommended community college LAN design
technologies that offer complete failure transparency to the end users and applications by default develops a non-optimal topology that keeps the network under-utilized and
during planned or unplanned network outages. requires protocol-based network recovery. In the same network design, the routed access
model eliminates such limitations and enables the full load balancing capabilities to
Cisco high availability technologies can be deployed based on critical versus non-critical
increase bandwidth capacity and minimize the application impact during a single path
platform roles in the network. Some of the high availability techniques can be achieved
failure. To develop a consistent network resiliency service in the centralized main and
with the LAN network design inherent within the community college network design,
remote college campus sites, the following basic principles apply:
without making major network changes. However, the critical network systems that are
deployed in the main campus that provide global connectivity may require additional • Deploying redundant parallel paths are the basic requirement to employ network
hardware and software components to provide non-stop communications. The following resiliency at any tier. It is critical to simplify the control plane and forwarding plane
three major resiliency requirements encompass most of the common types of failure operation by bundling all physical paths into a single logical bundled interface
conditions; depending on the LAN design tier, the resiliency option appropriate to the role (EtherChannel). Implement a defense-in-depth approach to failure detection and
and network service type must be deployed: recovery mechanisms. An example of this is configuring the UniDirectional Link
Detection (UDLD) protocol, which uses a Layer 2 keep-alive to test that the
• Network resiliency—Provides redundancy during physical link failures, such as fiber
switch-to-switch links are connected and operating correctly, and acts as a backup to
cut, bad transceivers, incorrect cablings, and so on.
the native Layer 1 unidirectional link detection capabilities provided by 802.3z and
Community College LAN Design SBA

802.3ae standards. UDLD is not an EtherChannel function; it operates independently Redundant Control Plane
over each individual physical port at Layer 2 and remains transparent to the rest of the Device or node resiliency in modular Cisco Catalyst 6500/4500 platforms and Cisco
port configuration. Therefore, UDLD can be deployed on ports implemented in Layer StackWise provides a 1+1 redundancy option with enterprise-class high availability and
2 or Layer 3 modes. deterministic network recovery time. The following sub-sections provide high availability
• Ensure that the design is self-stabilizing. Hardware or software errors may cause design details, as well as graceful network recovery techniques that do not impact the
ports to flap, which creates false alarms and destabilizes the network topology. control plane and provide constant forwarding capabilities during failure events.
Implementing route summarization advertises a concise topology view to the
network, which prevents core network instability. However, within the summarized Stateful Switchover
boundary, the flood may not be protected. Deploy IP event dampening as an tool to
prevent the control and forwarding plane impact caused by physical topology The stateful switchover (SSO) capability in modular switching platforms such as the Cisco
instability. Catalyst 4500 and 6500 provides complete carrier-class high availability in the campus
network. Cisco recommends distribution and core layer design model be the center point
These principles are intended to be a complementary part of the overall structured
of the entire college communication network. Deploying redundant supervisors in the
modular design approach to the campus design, and serve primarily to reinforce good mission-critical distribution and core system provides non-stop communication
resilient design practices.
throughout the network. To provide 99.999 percent service availability in the access layer,
the Catalyst 4500 must be equipped with redundant supervisors to critical endpoints,
Device Resiliency Best Practices such as Cisco TelePresence.
Another major component of an overall campus high availability framework is providing Cisco StackWise is an low-cost solution to provide device-level high availability. Cisco
device or node level protection that can be triggered during any type of abnormal internal StackWise is designed with unique hardware and software capabilities that distribute,
hardware or software process within the system. Some of the common internal failures synchronize, and protect common forwarding information across all member switches in
are a software-triggered crash, power outages, line card failures, and so on. LAN network a stack ring. During master switch failure, the new master switch re-election remains
devices can be considered as a single-point-of-failure and are considered to be major transparent to the network devices and endpoints. Deploying Cisco StackWise according
failure condition because the recovery type may require a network administrator to to the recommended guidelines protects against network interruption, and recovers the
mitigate the failure and recover the system. The network recovery time can remain network in sub-seconds during master switch re-election.
undeterministic, causing complete or partial network outage, depending on the network Bundling SSO with NSF capability and the awareness function allows the network to
design. operate without errors during a primary supervisor module failure. Users of realtime
Redundant hardware components for device resiliency vary between fixed configuration applications such as VoIP do not hang up the phone, and IP video surveillance cameras
and modular Cisco Catalyst switches. To protect against common network faults or resets, do not freeze.
all critical community college campus network devices must be deployed with a similar
device resiliency configuration. This subsection provides basic redundant hardware Non-Stop Forwarding
deployment guidelines at the access layer and collapsed core switching platforms in the
campus network. Cisco VSS and the single highly resilient-based campus system provides uninterrupted
network availability using non-stop forwarding (NSF) without impacting end-to-end
application performance. The Cisco VSS and redundant supervisor system is an
Redundant Power System NSF-capable platform; thus, every network device that connects to VSS or the redundant
Redundant power supplies for network systems protect against power outages, power supervisor system must be NSF-aware to provide optimal resiliency. By default, most
supply failures, and so on. It is important not only to protect the internal network system but Cisco Layer 3 network devices are NSF-aware systems that operate in NSF helper mode
also the endpoints that rely on power delivery over the Ethernet network. Redundant for graceful network recovery. (See Figure 36.)
power systems can be deployed in the two following configuration modes:
• Modular switch—Dual power supplies can be deployed in modular switching
platforms such as the Cisco Catalyst 6500 and 4500-E Series platforms. By default,
the power supply operates in redundant mode, offering the 1+1 redundant option.
Overall power capacity planning must be done to dynamically allow for network
growth. Lower power supplies can be combined to allocate power to all internal and
external resources, but may not be able to offer power redundancy.
• Fixed configuration switch—The power supply in fixed configuration switches can be
internal or use Cisco RPS 2300 external power supplies. A single Cisco RPS 2300
power supply uses a modular power supply and fan for flexibility, and can deliver
power to multiple switches. Deploying an internal and external power supply solution
protects critical access layer switches during power outages, and provides
completes fault transparency and constant network availability.
Community College LAN Design SBA

Figure 36 Community College LAN Design NSF/SSO Capable and Aware Systems Having the ability to operate the campus as a non-stop system depends on the
appropriate capabilities being designed-in from the start. Network and device level
redundancy, along with the necessary software control mechanisms, guarantee
Edge NSF-Capable NSF-Aware controlled and fast recovery of all data flows following any network failure, while
QFP
concurrently providing the ability to proactively manage the non-stop infrastructure.

Catalyst 6500 VSS—eFSU

Switch-1 Switch-2 A network upgrade requires planned network and system downtime. VSS offers
Active Standby unmatched network availability to the core. With the Enhanced Fast Software Upgrade
VSL
Core (eFSU) feature, the VSS can continue to provide network services during the upgrade.
NSF-Capable
With the eFSU feature, the VSS network upgrade remains transparent and hitless to the
applications and end users (see Figure 37). Because eFSU works in conjunction with
NSF/SSO technology, the network devices can gracefully restore control and forwarding
information during the upgrade process, while the bandwidth capacity operates at 50
Switch-1 Switch-2
Active Standby percent and the data plane can converge within sub-seconds.
VSL
Distribution For a hitless software update, the ISSU process requires three sequential upgrade events
NSF-Capable
for error-free software install on both virtual switch systems. Each upgrade event causes
traffic to be re-routed to a redundant MEC path, causing sub-second traffic loss that does
not impact realtime network applications, such as VoIP.
Standby
Figure 37 Real-time Network Upgrade Events and Availability
Active
Access Operating
Bandwidth
228501

Capacity
NSF-Aware NSF-Capable
100%1

Operational Resiliency Best Practices

Designing the network to recover from failure events is only one aspect of the overall
campus non-stop design. Converged network environments are continuing to move
toward requiring true 7x24x365 availability. The community college LAN network is part of
the backbone of the college network and must be designed to enable standard
operational processes, configuration changes, and software and hardware upgrades 50%2
without disrupting network services.
The ability to make changes, upgrade software, and replace or upgrade hardware
becomes challenging without a redundant system in the campus core. The ability to eFSU
upgrade individual devices without taking them out of service is similarly based on having Events
1 2 3 4 5
internal component redundancy (such as with power supplies and supervisors), Switch 2 - Switch 1 - ISSU Switch 1 -
ISSU ISSU acceptversion ISSU
complemented with the system software capabilities. The Cisco Catalyst 4500 and 6500 loadversion loadversion runversion
support realtime upgrade software in the campus.

228502
1
Both virtual-system nodes forwarding traffic
2Single virtual-system node forwarding traffic
Catalyst 4500—ISSU
Full-image ISSU on the Cisco Catalyst 4500 leverages dual supervisors to allow for a full,
in-place Cisco IOS upgrade, such as moving from 12.2(50)SG to 12.2(53)SG for example. Summary
This leverages the NSF/SSO capabilities of the switch and provides for less than 200 Designing the LAN network aspects for the community college network design
msec of traffic loss during a full Cisco IOS upgrade. establishes the foundation for all other aspects within the service fabric (WAN, security,
mobility, and UC) as well as laying the foundation to provide safety and security,
operational efficiencies, virtual learning environments, and secure classrooms.
Community College LAN Design SBA

This chapter reviews the two LAN design models recommended by Cisco, as well as
where to apply these models within the various locations of a community college network.
Each of the layers is discussed and design guidance is provided on where to place and
how to deploy these layers. Finally, key network foundation services such as routing,
switching, QoS, multicast, and high availability best practices are given for the entire
community college design.